Re:Use LetsEncrypt and CloudFlare to secure any Heroku app f...
by petrosagg on Thursday July 21, 2016 @10:26PM
(#12141354)
>No more jQuery from Google CDN, no more analytics/exception tracking/fonts from your favoured provider and no more advertising conversion tracking
You don't have to trust the CDN for any static resource you load as long as you use the subresource integrity feature of modern browsers[1]. You basically include the hash of the content on your main domain and the browser will validate it when it loads it from CDN. So you only need to trust your main site.
You don't have to trust the CDN for any static resource you load as long as you use the subresource integrity feature of modern browsers[1]. You basically include the hash of the content on your main domain and the browser will validate it when it loads it from CDN. So you only need to trust your main site.
[1] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
Edit: It was already mentioned by michaelmior https://news.ycombinator.com/item?id=12138277